WORLDTECHGlow Labs finds AI coding agents installing deprecated MCP servers
Research from Glow Labs, as reported by Help Net Security, describes AI coding agents selecting deprecated MCP servers when developers ask for one. The researchers call the pattern MCPhantom.
What the session transcripts show
Glow Labs reviewed transcripts of real AI coding sessions and documented cases in which the agent selected a server from an archived repository. That repository will never be patched again.
When a developer tells an agent to set up a GitHub MCP, the agent has to choose a package to install. In the sessions reviewed, that choice fell on a deprecated option.
Unpatched servers remain on machines
Help Net Security reports the finding, crediting Glow Security and Glow Labs. The report does not say how often the affected servers were exploited, nor how many machines are affected.
The finding rests on this single report.
Open questions
- How many developer machines were affected in practice?
- Which deprecated MCP servers were installed in the documented sessions?